Cyberthreats: Sometimes Hollywood gets it right
Connecting state and local government leaders
Security experts look at cyber attacks in some popular movies from the last 30 years and find that amid all of the silliness some of the worst case scenarios are disturbingly realistic.
Hackers—teenage prodigies or evil geniuses—have been staple Hollywood characters since the birth of the Internet. But just how realistic are those Hollywood movies featuring cyber attacks?
The good news is that the risk of an accidental thermonuclear war instigated by a bright teenager, a la Matthew Broderick in 1983’s "War Games," is just Hollywood hokum, said retired Lt. Gen. Charlie Croom, now vice president for cyber security solutions for Lockheed Martin. Croom, former director of the Defense Information Systems Agency and commander of the Joint Task Force for Global Network Operations, does give high marks to the movie’s sets, however. The war room in "War Games" is similar to the real thing, formerly housed in Cheyenne Mountain, he said.
But a panel of security experts who analyzed cyber attacks in popular movies from the past 30 years rated a surprising number of the scenarios “doable.” Although not necessarily with spectacular effects such as the exploding refinery in 2007’s "Live Free or Die Hard," Bruce Willis’s fourth outing in the "Die Hard" series.
“You can’t control where it blows,” said Scott Borg, director of the U.S. Cyber Consequences Unit. “But you can make one big explosion and do a lot of damage in a designated area” by controlling pipeline pumps. “It’s doable.”
The experts made their assessments during last week’s 10th anniversary celebration of the Internet Security Alliance, where incidents from five movies were evaluated. The most unrealistic element of War Games, said Tim McKnight, a former FBI special agent and now vice president of information security for Northrop Grumman Corp., was “a cute looking girl in the room.” In all his years of serving warrants on male teenage hackers, that never happened, he said.
But the phone hacking and online grade changing depicted in the movie was real. “What is still one of the most common data destruction crimes is people changing grades,” Borg said.
Croom said the Defense Department’s greatest fear from hackers was not the theft of information, but the ability to change information.
That danger was demonstrated in the 1995 movie "The Net," in which a hospital patient is killed by someone tampering with his medical records, and Sandra Bullock’s character's identity is erased. Although erasing an identity would be difficult, health IT systems today still are disturbingly insecure, the experts said.
Evaluations of hospital IT systems have revealed a variety of vulnerabilities for changing records, Borg said, noting that “We found multiple ways to kill a person." It would be easy to identify patients under the care of multiple doctors, who would find it difficult to detect the malicious changes.
The fast flux address changes used to hide a malicious server in 2008’s "Untraceable" would be difficult to pull off with the streaming video feed featured in that movie, but the technique is used today to protect botnet command and control servers. “This is how a lot of recent worms like Conficker function,” Borg said. The story emphasized the anonymity of the Internet and the difficulty of attribution for online events.
How about hacking into critical infrastructure, as in the 1992 cyber thriller "Sneakers" with Robert Redford and Sidney Poitier?
“The Air Traffic Control system is fairly doable,” Borg said. “The power grid is doable, but it is extremely hard.” About the Federal Reserve System’s transfer wire he could not say. It is supposed to be a separate system, air gapped from the Internet, but “there is always a way in.”
And how about disrupting the nation’s transportation system, as in "Live Free or Die Hard?" “Train crashes are very doable,” Borg acknowledged. Shutting down street grids is less so. “We in America cope with traffic lights going out very well.” When the lights go out, Americans direct traffic. We are good at that, he said.
With all of these attacks possible against critical infrastructure and systems, is Borg surprised that it has not yet been done on a significant scale?
“No,” he said. “Most of the bad attacks are hard to do.” So far we have been staying ahead of the bad guys who might try to do these things to our systems. “People don’t give our industries enough credit for protecting them.”
NEXT STORY: DARPA plans to SMITE insider enemies